feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
"""Tests for agent/anthropic_adapter.py — Anthropic Messages API adapter."""
|
|
|
|
|
|
|
|
|
|
import json
|
|
|
|
|
import time
|
|
|
|
|
from types import SimpleNamespace
|
|
|
|
|
from unittest.mock import patch, MagicMock
|
|
|
|
|
|
|
|
|
|
import pytest
|
|
|
|
|
|
2026-03-13 13:27:03 -07:00
|
|
|
from agent.prompt_caching import apply_anthropic_cache_control
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
from agent.anthropic_adapter import (
|
|
|
|
|
_is_oauth_token,
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
_refresh_oauth_token,
|
|
|
|
|
_write_claude_code_credentials,
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
build_anthropic_client,
|
|
|
|
|
build_anthropic_kwargs,
|
|
|
|
|
convert_messages_to_anthropic,
|
|
|
|
|
convert_tools_to_anthropic,
|
|
|
|
|
is_claude_code_token_valid,
|
|
|
|
|
normalize_anthropic_response,
|
|
|
|
|
normalize_model_name,
|
|
|
|
|
read_claude_code_credentials,
|
|
|
|
|
resolve_anthropic_token,
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
run_oauth_setup_token,
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Auth helpers
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestIsOAuthToken:
|
|
|
|
|
def test_setup_token(self):
|
|
|
|
|
assert _is_oauth_token("sk-ant-oat01-abcdef1234567890") is True
|
|
|
|
|
|
|
|
|
|
def test_api_key(self):
|
|
|
|
|
assert _is_oauth_token("sk-ant-api03-abcdef1234567890") is False
|
|
|
|
|
|
2026-03-12 17:14:22 -07:00
|
|
|
def test_managed_key(self):
|
|
|
|
|
# Managed keys from ~/.claude.json are NOT regular API keys
|
|
|
|
|
assert _is_oauth_token("ou1R1z-ft0A-bDeZ9wAA") is True
|
|
|
|
|
|
|
|
|
|
def test_jwt_token(self):
|
|
|
|
|
# JWTs from OAuth flow
|
|
|
|
|
assert _is_oauth_token("eyJhbGciOiJSUzI1NiJ9.test") is True
|
|
|
|
|
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
def test_empty(self):
|
|
|
|
|
assert _is_oauth_token("") is False
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestBuildAnthropicClient:
|
|
|
|
|
def test_setup_token_uses_auth_token(self):
|
|
|
|
|
with patch("agent.anthropic_adapter._anthropic_sdk") as mock_sdk:
|
|
|
|
|
build_anthropic_client("sk-ant-oat01-" + "x" * 60)
|
|
|
|
|
kwargs = mock_sdk.Anthropic.call_args[1]
|
|
|
|
|
assert "auth_token" in kwargs
|
fix(anthropic): address gaps found in deep-dive audit
After studying clawdbot (OpenClaw) and OpenCode implementations:
## Beta headers
- Add interleaved-thinking-2025-05-14 and fine-grained-tool-streaming-2025-05-14
as common betas (sent with ALL auth types, not just OAuth)
- OAuth tokens additionally get oauth-2025-04-20
- API keys now also get the common betas (previously got none)
## Vision/image support
- Add _convert_vision_content() to convert OpenAI multimodal format
(image_url blocks) to Anthropic format (image blocks with base64/url source)
- Handles both data: URIs (base64) and regular URLs
## Role alternation enforcement
- Anthropic strictly rejects consecutive same-role messages (400 error)
- Add post-processing step that merges consecutive user/assistant messages
- Handles string, list, and mixed content types during merge
## Tool choice support
- Add tool_choice parameter to build_anthropic_kwargs()
- Maps OpenAI values: auto→auto, required→any, none→omit, name→tool
## Cache metrics tracking
- Anthropic uses cache_read_input_tokens / cache_creation_input_tokens
(different from OpenRouter's prompt_tokens_details.cached_tokens)
- Add api_mode-aware branch in run_agent.py cache stats logging
## Credential refresh on 401
- On 401 error during anthropic_messages mode, re-read credentials
via resolve_anthropic_token() (picks up refreshed Claude Code tokens)
- Rebuild client if new token differs from current one
- Follows same pattern as Codex/Nous 401 refresh handlers
## Tests
- 44 adapter tests (8 new: vision conversion, role alternation, tool choice)
- Updated beta header tests to verify new structure
- Full suite: 3198 passed, 0 regressions
2026-03-12 16:00:46 -07:00
|
|
|
betas = kwargs["default_headers"]["anthropic-beta"]
|
|
|
|
|
assert "oauth-2025-04-20" in betas
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
assert "claude-code-20250219" in betas
|
fix(anthropic): address gaps found in deep-dive audit
After studying clawdbot (OpenClaw) and OpenCode implementations:
## Beta headers
- Add interleaved-thinking-2025-05-14 and fine-grained-tool-streaming-2025-05-14
as common betas (sent with ALL auth types, not just OAuth)
- OAuth tokens additionally get oauth-2025-04-20
- API keys now also get the common betas (previously got none)
## Vision/image support
- Add _convert_vision_content() to convert OpenAI multimodal format
(image_url blocks) to Anthropic format (image blocks with base64/url source)
- Handles both data: URIs (base64) and regular URLs
## Role alternation enforcement
- Anthropic strictly rejects consecutive same-role messages (400 error)
- Add post-processing step that merges consecutive user/assistant messages
- Handles string, list, and mixed content types during merge
## Tool choice support
- Add tool_choice parameter to build_anthropic_kwargs()
- Maps OpenAI values: auto→auto, required→any, none→omit, name→tool
## Cache metrics tracking
- Anthropic uses cache_read_input_tokens / cache_creation_input_tokens
(different from OpenRouter's prompt_tokens_details.cached_tokens)
- Add api_mode-aware branch in run_agent.py cache stats logging
## Credential refresh on 401
- On 401 error during anthropic_messages mode, re-read credentials
via resolve_anthropic_token() (picks up refreshed Claude Code tokens)
- Rebuild client if new token differs from current one
- Follows same pattern as Codex/Nous 401 refresh handlers
## Tests
- 44 adapter tests (8 new: vision conversion, role alternation, tool choice)
- Updated beta header tests to verify new structure
- Full suite: 3198 passed, 0 regressions
2026-03-12 16:00:46 -07:00
|
|
|
assert "interleaved-thinking-2025-05-14" in betas
|
|
|
|
|
assert "fine-grained-tool-streaming-2025-05-14" in betas
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
assert "api_key" not in kwargs
|
|
|
|
|
|
|
|
|
|
def test_api_key_uses_api_key(self):
|
|
|
|
|
with patch("agent.anthropic_adapter._anthropic_sdk") as mock_sdk:
|
|
|
|
|
build_anthropic_client("sk-ant-api03-something")
|
|
|
|
|
kwargs = mock_sdk.Anthropic.call_args[1]
|
|
|
|
|
assert kwargs["api_key"] == "sk-ant-api03-something"
|
|
|
|
|
assert "auth_token" not in kwargs
|
fix(anthropic): address gaps found in deep-dive audit
After studying clawdbot (OpenClaw) and OpenCode implementations:
## Beta headers
- Add interleaved-thinking-2025-05-14 and fine-grained-tool-streaming-2025-05-14
as common betas (sent with ALL auth types, not just OAuth)
- OAuth tokens additionally get oauth-2025-04-20
- API keys now also get the common betas (previously got none)
## Vision/image support
- Add _convert_vision_content() to convert OpenAI multimodal format
(image_url blocks) to Anthropic format (image blocks with base64/url source)
- Handles both data: URIs (base64) and regular URLs
## Role alternation enforcement
- Anthropic strictly rejects consecutive same-role messages (400 error)
- Add post-processing step that merges consecutive user/assistant messages
- Handles string, list, and mixed content types during merge
## Tool choice support
- Add tool_choice parameter to build_anthropic_kwargs()
- Maps OpenAI values: auto→auto, required→any, none→omit, name→tool
## Cache metrics tracking
- Anthropic uses cache_read_input_tokens / cache_creation_input_tokens
(different from OpenRouter's prompt_tokens_details.cached_tokens)
- Add api_mode-aware branch in run_agent.py cache stats logging
## Credential refresh on 401
- On 401 error during anthropic_messages mode, re-read credentials
via resolve_anthropic_token() (picks up refreshed Claude Code tokens)
- Rebuild client if new token differs from current one
- Follows same pattern as Codex/Nous 401 refresh handlers
## Tests
- 44 adapter tests (8 new: vision conversion, role alternation, tool choice)
- Updated beta header tests to verify new structure
- Full suite: 3198 passed, 0 regressions
2026-03-12 16:00:46 -07:00
|
|
|
# API key auth should still get common betas
|
|
|
|
|
betas = kwargs["default_headers"]["anthropic-beta"]
|
|
|
|
|
assert "interleaved-thinking-2025-05-14" in betas
|
|
|
|
|
assert "oauth-2025-04-20" not in betas # OAuth-only beta NOT present
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
assert "claude-code-20250219" not in betas # OAuth-only beta NOT present
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
|
|
|
|
|
def test_custom_base_url(self):
|
|
|
|
|
with patch("agent.anthropic_adapter._anthropic_sdk") as mock_sdk:
|
|
|
|
|
build_anthropic_client("sk-ant-api03-x", base_url="https://custom.api.com")
|
|
|
|
|
kwargs = mock_sdk.Anthropic.call_args[1]
|
|
|
|
|
assert kwargs["base_url"] == "https://custom.api.com"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestReadClaudeCodeCredentials:
|
|
|
|
|
def test_reads_valid_credentials(self, tmp_path, monkeypatch):
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "sk-ant-oat01-test-token",
|
|
|
|
|
"refreshToken": "sk-ant-ort01-refresh",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) + 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
creds = read_claude_code_credentials()
|
|
|
|
|
assert creds is not None
|
|
|
|
|
assert creds["accessToken"] == "sk-ant-oat01-test-token"
|
|
|
|
|
assert creds["refreshToken"] == "sk-ant-ort01-refresh"
|
|
|
|
|
|
|
|
|
|
def test_returns_none_for_missing_file(self, tmp_path, monkeypatch):
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert read_claude_code_credentials() is None
|
|
|
|
|
|
|
|
|
|
def test_returns_none_for_missing_oauth_key(self, tmp_path, monkeypatch):
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({"someOtherKey": {}}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert read_claude_code_credentials() is None
|
|
|
|
|
|
|
|
|
|
def test_returns_none_for_empty_access_token(self, tmp_path, monkeypatch):
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {"accessToken": "", "refreshToken": "x"}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert read_claude_code_credentials() is None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestIsClaudeCodeTokenValid:
|
|
|
|
|
def test_valid_token(self):
|
|
|
|
|
creds = {"accessToken": "tok", "expiresAt": int(time.time() * 1000) + 3600_000}
|
|
|
|
|
assert is_claude_code_token_valid(creds) is True
|
|
|
|
|
|
|
|
|
|
def test_expired_token(self):
|
|
|
|
|
creds = {"accessToken": "tok", "expiresAt": int(time.time() * 1000) - 3600_000}
|
|
|
|
|
assert is_claude_code_token_valid(creds) is False
|
|
|
|
|
|
|
|
|
|
def test_no_expiry_but_has_token(self):
|
|
|
|
|
creds = {"accessToken": "tok", "expiresAt": 0}
|
|
|
|
|
assert is_claude_code_token_valid(creds) is True
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestResolveAnthropicToken:
|
2026-03-13 02:09:52 -07:00
|
|
|
def test_prefers_oauth_token_over_api_key(self, monkeypatch):
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-api03-mykey")
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_TOKEN", "sk-ant-oat01-mytoken")
|
2026-03-13 02:09:52 -07:00
|
|
|
assert resolve_anthropic_token() == "sk-ant-oat01-mytoken"
|
|
|
|
|
|
|
|
|
|
def test_falls_back_to_api_key_when_no_oauth_sources_exist(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-api03-mykey")
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
assert resolve_anthropic_token() == "sk-ant-api03-mykey"
|
|
|
|
|
|
|
|
|
|
def test_falls_back_to_token(self, monkeypatch):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_TOKEN", "sk-ant-oat01-mytoken")
|
|
|
|
|
assert resolve_anthropic_token() == "sk-ant-oat01-mytoken"
|
|
|
|
|
|
|
|
|
|
def test_returns_none_with_no_creds(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert resolve_anthropic_token() is None
|
|
|
|
|
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
def test_falls_back_to_claude_code_oauth_token(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "sk-ant-oat01-test-token")
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert resolve_anthropic_token() == "sk-ant-oat01-test-token"
|
|
|
|
|
|
|
|
|
|
def test_falls_back_to_claude_code_credentials(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "cc-auto-token",
|
|
|
|
|
"refreshToken": "refresh",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) + 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
assert resolve_anthropic_token() == "cc-auto-token"
|
|
|
|
|
|
2026-03-14 19:22:31 -07:00
|
|
|
def test_prefers_refreshable_claude_code_credentials_over_static_anthropic_token(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_TOKEN", "sk-ant-oat01-static-token")
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "cc-auto-token",
|
|
|
|
|
"refreshToken": "refresh-token",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) + 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
assert resolve_anthropic_token() == "cc-auto-token"
|
|
|
|
|
|
|
|
|
|
def test_keeps_static_anthropic_token_when_only_non_refreshable_claude_key_exists(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_TOKEN", "sk-ant-oat01-static-token")
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
claude_json = tmp_path / ".claude.json"
|
|
|
|
|
claude_json.write_text(json.dumps({"primaryApiKey": "sk-ant-api03-managed-key"}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
assert resolve_anthropic_token() == "sk-ant-oat01-static-token"
|
|
|
|
|
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
|
|
|
|
|
class TestRefreshOauthToken:
|
|
|
|
|
def test_returns_none_without_refresh_token(self):
|
|
|
|
|
creds = {"accessToken": "expired", "refreshToken": "", "expiresAt": 0}
|
|
|
|
|
assert _refresh_oauth_token(creds) is None
|
|
|
|
|
|
|
|
|
|
def test_successful_refresh(self, tmp_path, monkeypatch):
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
creds = {
|
|
|
|
|
"accessToken": "old-token",
|
|
|
|
|
"refreshToken": "refresh-123",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) - 3600_000,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
mock_response = json.dumps({
|
|
|
|
|
"access_token": "new-token-abc",
|
|
|
|
|
"refresh_token": "new-refresh-456",
|
|
|
|
|
"expires_in": 7200,
|
|
|
|
|
}).encode()
|
|
|
|
|
|
|
|
|
|
with patch("urllib.request.urlopen") as mock_urlopen:
|
|
|
|
|
mock_ctx = MagicMock()
|
|
|
|
|
mock_ctx.__enter__ = MagicMock(return_value=MagicMock(
|
|
|
|
|
read=MagicMock(return_value=mock_response)
|
|
|
|
|
))
|
|
|
|
|
mock_ctx.__exit__ = MagicMock(return_value=False)
|
|
|
|
|
mock_urlopen.return_value = mock_ctx
|
|
|
|
|
|
|
|
|
|
result = _refresh_oauth_token(creds)
|
|
|
|
|
|
|
|
|
|
assert result == "new-token-abc"
|
|
|
|
|
# Verify credentials were written back
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
assert cred_file.exists()
|
|
|
|
|
written = json.loads(cred_file.read_text())
|
|
|
|
|
assert written["claudeAiOauth"]["accessToken"] == "new-token-abc"
|
|
|
|
|
assert written["claudeAiOauth"]["refreshToken"] == "new-refresh-456"
|
|
|
|
|
|
|
|
|
|
def test_failed_refresh_returns_none(self):
|
|
|
|
|
creds = {
|
|
|
|
|
"accessToken": "old",
|
|
|
|
|
"refreshToken": "refresh-123",
|
|
|
|
|
"expiresAt": 0,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
with patch("urllib.request.urlopen", side_effect=Exception("network error")):
|
|
|
|
|
assert _refresh_oauth_token(creds) is None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestWriteClaudeCodeCredentials:
|
|
|
|
|
def test_writes_new_file(self, tmp_path, monkeypatch):
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
_write_claude_code_credentials("tok", "ref", 12345)
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
assert cred_file.exists()
|
|
|
|
|
data = json.loads(cred_file.read_text())
|
|
|
|
|
assert data["claudeAiOauth"]["accessToken"] == "tok"
|
|
|
|
|
assert data["claudeAiOauth"]["refreshToken"] == "ref"
|
|
|
|
|
assert data["claudeAiOauth"]["expiresAt"] == 12345
|
|
|
|
|
|
|
|
|
|
def test_preserves_existing_fields(self, tmp_path, monkeypatch):
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
cred_dir = tmp_path / ".claude"
|
|
|
|
|
cred_dir.mkdir()
|
|
|
|
|
cred_file = cred_dir / ".credentials.json"
|
|
|
|
|
cred_file.write_text(json.dumps({"otherField": "keep-me"}))
|
|
|
|
|
_write_claude_code_credentials("new-tok", "new-ref", 99999)
|
|
|
|
|
data = json.loads(cred_file.read_text())
|
|
|
|
|
assert data["otherField"] == "keep-me"
|
|
|
|
|
assert data["claudeAiOauth"]["accessToken"] == "new-tok"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestResolveWithRefresh:
|
|
|
|
|
def test_auto_refresh_on_expired_creds(self, monkeypatch, tmp_path):
|
|
|
|
|
"""When cred file has expired token + refresh token, auto-refresh is attempted."""
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
|
|
|
|
|
# Set up expired creds with a refresh token
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "expired-tok",
|
|
|
|
|
"refreshToken": "valid-refresh",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) - 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
# Mock refresh to succeed
|
|
|
|
|
with patch("agent.anthropic_adapter._refresh_oauth_token", return_value="refreshed-token"):
|
|
|
|
|
result = resolve_anthropic_token()
|
|
|
|
|
|
|
|
|
|
assert result == "refreshed-token"
|
|
|
|
|
|
2026-03-14 19:22:31 -07:00
|
|
|
def test_static_env_oauth_token_does_not_block_refreshable_claude_creds(self, monkeypatch, tmp_path):
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
|
|
|
|
|
monkeypatch.setenv("ANTHROPIC_TOKEN", "sk-ant-oat01-expired-env-token")
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "expired-claude-creds-token",
|
|
|
|
|
"refreshToken": "valid-refresh",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) - 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
with patch("agent.anthropic_adapter._refresh_oauth_token", return_value="refreshed-token"):
|
|
|
|
|
result = resolve_anthropic_token()
|
|
|
|
|
|
|
|
|
|
assert result == "refreshed-token"
|
|
|
|
|
|
fix: Anthropic OAuth — beta header, token refresh, config contamination, reauthentication (#1132)
Fixes Anthropic OAuth/subscription authentication end-to-end:
Auth failures (401 errors):
- Add missing 'claude-code-20250219' beta header for OAuth tokens. Both
clawdbot and OpenCode include this alongside 'oauth-2025-04-20' — without
it, Anthropic's API rejects OAuth tokens with 401 authentication errors.
- Fix _fetch_anthropic_models() to use canonical beta headers from
_COMMON_BETAS + _OAUTH_ONLY_BETAS instead of hardcoding.
Token refresh:
- Add _refresh_oauth_token() — when Claude Code credentials from
~/.claude/.credentials.json are expired but have a refresh token,
automatically POST to console.anthropic.com/v1/oauth/token to get
a new access token. Uses the same client_id as Claude Code / OpenCode.
- Add _write_claude_code_credentials() — writes refreshed tokens back
to ~/.claude/.credentials.json, preserving other fields.
- resolve_anthropic_token() now auto-refreshes expired tokens before
returning None.
Config contamination:
- Anthropic's _model_flow_anthropic() no longer saves base_url to config.
Since resolve_runtime_provider() always hardcodes Anthropic's URL, the
stale base_url was contaminating other providers when users switched
without re-running 'hermes model' (e.g., Codex hitting api.anthropic.com).
- _update_config_for_provider() now pops base_url when passed empty string.
- Same fix in setup.py.
Flow/UX (hermes model command):
- CLAUDE_CODE_OAUTH_TOKEN env var now checked in credential detection
- Reauthentication option when existing credentials found
- run_oauth_setup_token() runs 'claude setup-token' as interactive
subprocess, then auto-detects saved credentials
- Clean has_creds/needs_auth flow in both main.py and setup.py
Tests (14 new):
- Beta header assertions for claude-code-20250219
- Token refresh: successful refresh with credential writeback, failed
refresh returns None, no refresh token returns None
- Credential writeback: new file creation, preserving existing fields
- Auto-refresh integration in resolve_anthropic_token()
- CLAUDE_CODE_OAUTH_TOKEN fallback, credential file auto-discovery
- run_oauth_setup_token() (5 scenarios)
2026-03-12 20:45:50 -07:00
|
|
|
|
|
|
|
|
class TestRunOauthSetupToken:
|
|
|
|
|
def test_raises_when_claude_not_installed(self, monkeypatch):
|
|
|
|
|
monkeypatch.setattr("shutil.which", lambda _: None)
|
|
|
|
|
with pytest.raises(FileNotFoundError, match="claude.*CLI.*not installed"):
|
|
|
|
|
run_oauth_setup_token()
|
|
|
|
|
|
|
|
|
|
def test_returns_token_from_credential_files(self, monkeypatch, tmp_path):
|
|
|
|
|
"""After subprocess completes, reads credentials from Claude Code files."""
|
|
|
|
|
monkeypatch.setattr("shutil.which", lambda _: "/usr/bin/claude")
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
|
|
|
|
|
# Pre-create credential files that will be found after subprocess
|
|
|
|
|
cred_file = tmp_path / ".claude" / ".credentials.json"
|
|
|
|
|
cred_file.parent.mkdir(parents=True)
|
|
|
|
|
cred_file.write_text(json.dumps({
|
|
|
|
|
"claudeAiOauth": {
|
|
|
|
|
"accessToken": "from-cred-file",
|
|
|
|
|
"refreshToken": "refresh",
|
|
|
|
|
"expiresAt": int(time.time() * 1000) + 3600_000,
|
|
|
|
|
}
|
|
|
|
|
}))
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
with patch("subprocess.run") as mock_run:
|
|
|
|
|
mock_run.return_value = MagicMock(returncode=0)
|
|
|
|
|
token = run_oauth_setup_token()
|
|
|
|
|
|
|
|
|
|
assert token == "from-cred-file"
|
|
|
|
|
mock_run.assert_called_once()
|
|
|
|
|
|
|
|
|
|
def test_returns_token_from_env_var(self, monkeypatch, tmp_path):
|
|
|
|
|
"""Falls back to CLAUDE_CODE_OAUTH_TOKEN env var when no cred files."""
|
|
|
|
|
monkeypatch.setattr("shutil.which", lambda _: "/usr/bin/claude")
|
|
|
|
|
monkeypatch.setenv("CLAUDE_CODE_OAUTH_TOKEN", "from-env-var")
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
with patch("subprocess.run") as mock_run:
|
|
|
|
|
mock_run.return_value = MagicMock(returncode=0)
|
|
|
|
|
token = run_oauth_setup_token()
|
|
|
|
|
|
|
|
|
|
assert token == "from-env-var"
|
|
|
|
|
|
|
|
|
|
def test_returns_none_when_no_creds_found(self, monkeypatch, tmp_path):
|
|
|
|
|
"""Returns None when subprocess completes but no credentials are found."""
|
|
|
|
|
monkeypatch.setattr("shutil.which", lambda _: "/usr/bin/claude")
|
|
|
|
|
monkeypatch.delenv("CLAUDE_CODE_OAUTH_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.delenv("ANTHROPIC_TOKEN", raising=False)
|
|
|
|
|
monkeypatch.setattr("agent.anthropic_adapter.Path.home", lambda: tmp_path)
|
|
|
|
|
|
|
|
|
|
with patch("subprocess.run") as mock_run:
|
|
|
|
|
mock_run.return_value = MagicMock(returncode=0)
|
|
|
|
|
token = run_oauth_setup_token()
|
|
|
|
|
|
|
|
|
|
assert token is None
|
|
|
|
|
|
|
|
|
|
def test_returns_none_on_keyboard_interrupt(self, monkeypatch):
|
|
|
|
|
"""Returns None gracefully when user interrupts the flow."""
|
|
|
|
|
monkeypatch.setattr("shutil.which", lambda _: "/usr/bin/claude")
|
|
|
|
|
|
|
|
|
|
with patch("subprocess.run", side_effect=KeyboardInterrupt):
|
|
|
|
|
token = run_oauth_setup_token()
|
|
|
|
|
|
|
|
|
|
assert token is None
|
|
|
|
|
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Model name normalization
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestNormalizeModelName:
|
|
|
|
|
def test_strips_anthropic_prefix(self):
|
|
|
|
|
assert normalize_model_name("anthropic/claude-sonnet-4-20250514") == "claude-sonnet-4-20250514"
|
|
|
|
|
|
|
|
|
|
def test_leaves_bare_name(self):
|
|
|
|
|
assert normalize_model_name("claude-sonnet-4-20250514") == "claude-sonnet-4-20250514"
|
|
|
|
|
|
2026-03-13 03:08:14 -07:00
|
|
|
def test_converts_dots_to_hyphens(self):
|
|
|
|
|
"""OpenRouter uses dots (4.6), Anthropic uses hyphens (4-6)."""
|
|
|
|
|
assert normalize_model_name("anthropic/claude-opus-4.6") == "claude-opus-4-6"
|
|
|
|
|
assert normalize_model_name("anthropic/claude-sonnet-4.5") == "claude-sonnet-4-5"
|
|
|
|
|
assert normalize_model_name("claude-opus-4.6") == "claude-opus-4-6"
|
|
|
|
|
|
|
|
|
|
def test_already_hyphenated_unchanged(self):
|
|
|
|
|
"""Names already in Anthropic format should pass through."""
|
|
|
|
|
assert normalize_model_name("claude-opus-4-6") == "claude-opus-4-6"
|
|
|
|
|
assert normalize_model_name("claude-opus-4-5-20251101") == "claude-opus-4-5-20251101"
|
|
|
|
|
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Tool conversion
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestConvertTools:
|
|
|
|
|
def test_converts_openai_to_anthropic_format(self):
|
|
|
|
|
tools = [
|
|
|
|
|
{
|
|
|
|
|
"type": "function",
|
|
|
|
|
"function": {
|
|
|
|
|
"name": "search",
|
|
|
|
|
"description": "Search the web",
|
|
|
|
|
"parameters": {
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {"query": {"type": "string"}},
|
|
|
|
|
"required": ["query"],
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
result = convert_tools_to_anthropic(tools)
|
|
|
|
|
assert len(result) == 1
|
|
|
|
|
assert result[0]["name"] == "search"
|
|
|
|
|
assert result[0]["description"] == "Search the web"
|
|
|
|
|
assert result[0]["input_schema"]["properties"]["query"]["type"] == "string"
|
|
|
|
|
|
|
|
|
|
def test_empty_tools(self):
|
|
|
|
|
assert convert_tools_to_anthropic([]) == []
|
|
|
|
|
assert convert_tools_to_anthropic(None) == []
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Message conversion
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestConvertMessages:
|
|
|
|
|
def test_extracts_system_prompt(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "system", "content": "You are helpful."},
|
|
|
|
|
{"role": "user", "content": "Hello"},
|
|
|
|
|
]
|
|
|
|
|
system, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assert system == "You are helpful."
|
|
|
|
|
assert len(result) == 1
|
|
|
|
|
assert result[0]["role"] == "user"
|
|
|
|
|
|
|
|
|
|
def test_converts_tool_calls(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{
|
|
|
|
|
"role": "assistant",
|
|
|
|
|
"content": "Let me search.",
|
|
|
|
|
"tool_calls": [
|
|
|
|
|
{
|
|
|
|
|
"id": "tc_1",
|
|
|
|
|
"function": {
|
|
|
|
|
"name": "search",
|
|
|
|
|
"arguments": '{"query": "test"}',
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
},
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_1", "content": "search results"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
blocks = result[0]["content"]
|
|
|
|
|
assert blocks[0] == {"type": "text", "text": "Let me search."}
|
|
|
|
|
assert blocks[1]["type"] == "tool_use"
|
|
|
|
|
assert blocks[1]["id"] == "tc_1"
|
|
|
|
|
assert blocks[1]["input"] == {"query": "test"}
|
|
|
|
|
|
|
|
|
|
def test_converts_tool_results(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_1", "content": "result data"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assert result[0]["role"] == "user"
|
|
|
|
|
assert result[0]["content"][0]["type"] == "tool_result"
|
|
|
|
|
assert result[0]["content"][0]["tool_use_id"] == "tc_1"
|
|
|
|
|
|
|
|
|
|
def test_merges_consecutive_tool_results(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_1", "content": "result 1"},
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_2", "content": "result 2"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assert len(result) == 1
|
|
|
|
|
assert len(result[0]["content"]) == 2
|
|
|
|
|
|
|
|
|
|
def test_strips_orphaned_tool_use(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{
|
|
|
|
|
"role": "assistant",
|
|
|
|
|
"content": "",
|
|
|
|
|
"tool_calls": [
|
|
|
|
|
{"id": "tc_orphan", "function": {"name": "x", "arguments": "{}"}}
|
|
|
|
|
],
|
|
|
|
|
},
|
|
|
|
|
{"role": "user", "content": "never mind"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
# tc_orphan has no matching tool_result, should be stripped
|
|
|
|
|
assistant_blocks = result[0]["content"]
|
|
|
|
|
assert all(b.get("type") != "tool_use" for b in assistant_blocks)
|
|
|
|
|
|
|
|
|
|
def test_system_with_cache_control(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{
|
|
|
|
|
"role": "system",
|
|
|
|
|
"content": [
|
|
|
|
|
{"type": "text", "text": "System prompt", "cache_control": {"type": "ephemeral"}},
|
|
|
|
|
],
|
|
|
|
|
},
|
|
|
|
|
{"role": "user", "content": "Hi"},
|
|
|
|
|
]
|
|
|
|
|
system, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
# When cache_control is present, system should be a list of blocks
|
|
|
|
|
assert isinstance(system, list)
|
|
|
|
|
assert system[0]["cache_control"] == {"type": "ephemeral"}
|
|
|
|
|
|
2026-03-13 13:27:03 -07:00
|
|
|
def test_assistant_cache_control_blocks_are_preserved(self):
|
|
|
|
|
messages = apply_anthropic_cache_control([
|
|
|
|
|
{"role": "system", "content": "System prompt"},
|
|
|
|
|
{"role": "assistant", "content": "Hello from assistant"},
|
|
|
|
|
])
|
|
|
|
|
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assistant_blocks = result[0]["content"]
|
|
|
|
|
|
|
|
|
|
assert assistant_blocks[0]["type"] == "text"
|
|
|
|
|
assert assistant_blocks[0]["text"] == "Hello from assistant"
|
|
|
|
|
assert assistant_blocks[0]["cache_control"] == {"type": "ephemeral"}
|
|
|
|
|
|
|
|
|
|
def test_tool_cache_control_is_preserved_on_tool_result_block(self):
|
|
|
|
|
messages = apply_anthropic_cache_control([
|
|
|
|
|
{"role": "system", "content": "System prompt"},
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_1", "content": "result"},
|
|
|
|
|
])
|
|
|
|
|
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
tool_block = result[0]["content"][0]
|
|
|
|
|
|
|
|
|
|
assert tool_block["type"] == "tool_result"
|
|
|
|
|
assert tool_block["tool_use_id"] == "tc_1"
|
|
|
|
|
assert tool_block["content"] == "result"
|
|
|
|
|
assert tool_block["cache_control"] == {"type": "ephemeral"}
|
|
|
|
|
|
2026-03-13 20:44:25 -07:00
|
|
|
def test_empty_cached_assistant_tool_turn_converts_without_empty_text_block(self):
|
|
|
|
|
messages = apply_anthropic_cache_control([
|
|
|
|
|
{"role": "system", "content": "System prompt"},
|
|
|
|
|
{"role": "user", "content": "Find the skill"},
|
|
|
|
|
{
|
|
|
|
|
"role": "assistant",
|
|
|
|
|
"content": "",
|
|
|
|
|
"tool_calls": [
|
|
|
|
|
{"id": "tc_1", "function": {"name": "skill_view", "arguments": "{}"}},
|
|
|
|
|
],
|
|
|
|
|
},
|
|
|
|
|
{"role": "tool", "tool_call_id": "tc_1", "content": "result"},
|
|
|
|
|
])
|
|
|
|
|
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
|
|
|
|
|
assistant_turn = next(msg for msg in result if msg["role"] == "assistant")
|
|
|
|
|
assistant_blocks = assistant_turn["content"]
|
|
|
|
|
|
|
|
|
|
assert all(not (b.get("type") == "text" and b.get("text") == "") for b in assistant_blocks)
|
|
|
|
|
assert any(b.get("type") == "tool_use" for b in assistant_blocks)
|
|
|
|
|
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Build kwargs
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestBuildAnthropicKwargs:
|
|
|
|
|
def test_basic_kwargs(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "system", "content": "Be helpful."},
|
|
|
|
|
{"role": "user", "content": "Hi"},
|
|
|
|
|
]
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=messages,
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["model"] == "claude-sonnet-4-20250514"
|
|
|
|
|
assert kwargs["system"] == "Be helpful."
|
|
|
|
|
assert kwargs["max_tokens"] == 4096
|
|
|
|
|
assert "tools" not in kwargs
|
|
|
|
|
|
|
|
|
|
def test_strips_anthropic_prefix(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="anthropic/claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "Hi"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["model"] == "claude-sonnet-4-20250514"
|
|
|
|
|
|
2026-03-13 03:21:13 +01:00
|
|
|
def test_reasoning_config_maps_to_manual_thinking_for_pre_4_6_models(self):
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "think hard"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config={"enabled": True, "effort": "high"},
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["thinking"]["type"] == "enabled"
|
|
|
|
|
assert kwargs["thinking"]["budget_tokens"] == 16000
|
2026-03-13 03:21:13 +01:00
|
|
|
assert kwargs["temperature"] == 1
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
assert kwargs["max_tokens"] >= 16000 + 4096
|
2026-03-13 03:21:13 +01:00
|
|
|
assert "output_config" not in kwargs
|
|
|
|
|
|
|
|
|
|
def test_reasoning_config_maps_to_adaptive_thinking_for_4_6_models(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-opus-4-6",
|
|
|
|
|
messages=[{"role": "user", "content": "think hard"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config={"enabled": True, "effort": "high"},
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["thinking"] == {"type": "adaptive"}
|
|
|
|
|
assert kwargs["output_config"] == {"effort": "high"}
|
|
|
|
|
assert "budget_tokens" not in kwargs["thinking"]
|
|
|
|
|
assert "temperature" not in kwargs
|
|
|
|
|
assert kwargs["max_tokens"] == 4096
|
|
|
|
|
|
|
|
|
|
def test_reasoning_config_maps_xhigh_to_max_effort_for_4_6_models(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-6",
|
|
|
|
|
messages=[{"role": "user", "content": "think harder"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config={"enabled": True, "effort": "xhigh"},
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["thinking"] == {"type": "adaptive"}
|
|
|
|
|
assert kwargs["output_config"] == {"effort": "max"}
|
feat: native Anthropic provider with Claude Code credential auto-discovery
Add Anthropic as a first-class inference provider, bypassing OpenRouter
for direct API access. Uses the native Anthropic SDK with a full format
adapter (same pattern as the codex_responses api_mode).
## Auth (three methods, priority order)
1. ANTHROPIC_API_KEY env var (regular API key, sk-ant-api-*)
2. ANTHROPIC_TOKEN / CLAUDE_CODE_OAUTH_TOKEN env var (setup-token, sk-ant-oat-*)
3. Auto-discovery from ~/.claude/.credentials.json (Claude Code subscription)
- Reads Claude Code's OAuth credentials
- Checks token expiry with 60s buffer
- Setup tokens use Bearer auth + anthropic-beta: oauth-2025-04-20 header
- Regular API keys use standard x-api-key header
## Changes by file
### New files
- agent/anthropic_adapter.py — Client builder, message/tool/response
format conversion, Claude Code credential reader, token resolver.
Handles system prompt extraction, tool_use/tool_result blocks,
thinking/reasoning, orphaned tool_use cleanup, cache_control.
- tests/test_anthropic_adapter.py — 36 tests covering all adapter logic
### Modified files
- pyproject.toml — Add anthropic>=0.39.0 dependency
- hermes_cli/auth.py — Add 'anthropic' to PROVIDER_REGISTRY with
three env vars, plus 'claude'/'claude-code' aliases
- hermes_cli/models.py — Add model catalog, labels, aliases, provider order
- hermes_cli/main.py — Add 'anthropic' to --provider CLI choices
- hermes_cli/runtime_provider.py — Add Anthropic branch returning
api_mode='anthropic_messages' (before generic api_key fallthrough)
- hermes_cli/setup.py — Add Anthropic setup wizard with Claude Code
credential auto-discovery, model selection, OpenRouter tools prompt
- agent/auxiliary_client.py — Add claude-haiku-4-5 as aux model
- agent/model_metadata.py — Add bare Claude model context lengths
- run_agent.py — Add anthropic_messages api_mode:
* Client init (Anthropic SDK instead of OpenAI)
* API call dispatch (_anthropic_client.messages.create)
* Response validation (content blocks)
* finish_reason mapping (stop_reason -> finish_reason)
* Token usage (input_tokens/output_tokens)
* Response normalization (normalize_anthropic_response)
* Client interrupt/rebuild
* Prompt caching auto-enabled for native Anthropic
- tests/test_run_agent.py — Update test_anthropic_base_url_accepted to
expect native routing, add test_prompt_caching_native_anthropic
2026-03-12 15:47:45 -07:00
|
|
|
|
|
|
|
|
def test_reasoning_disabled(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "quick"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config={"enabled": False},
|
|
|
|
|
)
|
|
|
|
|
assert "thinking" not in kwargs
|
|
|
|
|
|
|
|
|
|
def test_default_max_tokens(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "Hi"}],
|
|
|
|
|
tools=None,
|
|
|
|
|
max_tokens=None,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["max_tokens"] == 16384
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Response normalization
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestNormalizeResponse:
|
|
|
|
|
def _make_response(self, content_blocks, stop_reason="end_turn"):
|
|
|
|
|
resp = SimpleNamespace()
|
|
|
|
|
resp.content = content_blocks
|
|
|
|
|
resp.stop_reason = stop_reason
|
|
|
|
|
resp.usage = SimpleNamespace(input_tokens=100, output_tokens=50)
|
|
|
|
|
return resp
|
|
|
|
|
|
|
|
|
|
def test_text_response(self):
|
|
|
|
|
block = SimpleNamespace(type="text", text="Hello world")
|
|
|
|
|
msg, reason = normalize_anthropic_response(self._make_response([block]))
|
|
|
|
|
assert msg.content == "Hello world"
|
|
|
|
|
assert reason == "stop"
|
|
|
|
|
assert msg.tool_calls is None
|
|
|
|
|
|
|
|
|
|
def test_tool_use_response(self):
|
|
|
|
|
blocks = [
|
|
|
|
|
SimpleNamespace(type="text", text="Searching..."),
|
|
|
|
|
SimpleNamespace(
|
|
|
|
|
type="tool_use",
|
|
|
|
|
id="tc_1",
|
|
|
|
|
name="search",
|
|
|
|
|
input={"query": "test"},
|
|
|
|
|
),
|
|
|
|
|
]
|
|
|
|
|
msg, reason = normalize_anthropic_response(
|
|
|
|
|
self._make_response(blocks, "tool_use")
|
|
|
|
|
)
|
|
|
|
|
assert msg.content == "Searching..."
|
|
|
|
|
assert reason == "tool_calls"
|
|
|
|
|
assert len(msg.tool_calls) == 1
|
|
|
|
|
assert msg.tool_calls[0].function.name == "search"
|
|
|
|
|
assert json.loads(msg.tool_calls[0].function.arguments) == {"query": "test"}
|
|
|
|
|
|
|
|
|
|
def test_thinking_response(self):
|
|
|
|
|
blocks = [
|
|
|
|
|
SimpleNamespace(type="thinking", thinking="Let me reason about this..."),
|
|
|
|
|
SimpleNamespace(type="text", text="The answer is 42."),
|
|
|
|
|
]
|
|
|
|
|
msg, reason = normalize_anthropic_response(self._make_response(blocks))
|
|
|
|
|
assert msg.content == "The answer is 42."
|
|
|
|
|
assert msg.reasoning == "Let me reason about this..."
|
|
|
|
|
|
|
|
|
|
def test_stop_reason_mapping(self):
|
|
|
|
|
block = SimpleNamespace(type="text", text="x")
|
|
|
|
|
_, r1 = normalize_anthropic_response(
|
|
|
|
|
self._make_response([block], "end_turn")
|
|
|
|
|
)
|
|
|
|
|
_, r2 = normalize_anthropic_response(
|
|
|
|
|
self._make_response([block], "tool_use")
|
|
|
|
|
)
|
|
|
|
|
_, r3 = normalize_anthropic_response(
|
|
|
|
|
self._make_response([block], "max_tokens")
|
|
|
|
|
)
|
|
|
|
|
assert r1 == "stop"
|
|
|
|
|
assert r2 == "tool_calls"
|
|
|
|
|
assert r3 == "length"
|
|
|
|
|
|
|
|
|
|
def test_no_text_content(self):
|
|
|
|
|
block = SimpleNamespace(
|
|
|
|
|
type="tool_use", id="tc_1", name="search", input={"q": "hi"}
|
|
|
|
|
)
|
|
|
|
|
msg, reason = normalize_anthropic_response(
|
|
|
|
|
self._make_response([block], "tool_use")
|
|
|
|
|
)
|
|
|
|
|
assert msg.content is None
|
|
|
|
|
assert len(msg.tool_calls) == 1
|
fix(anthropic): address gaps found in deep-dive audit
After studying clawdbot (OpenClaw) and OpenCode implementations:
## Beta headers
- Add interleaved-thinking-2025-05-14 and fine-grained-tool-streaming-2025-05-14
as common betas (sent with ALL auth types, not just OAuth)
- OAuth tokens additionally get oauth-2025-04-20
- API keys now also get the common betas (previously got none)
## Vision/image support
- Add _convert_vision_content() to convert OpenAI multimodal format
(image_url blocks) to Anthropic format (image blocks with base64/url source)
- Handles both data: URIs (base64) and regular URLs
## Role alternation enforcement
- Anthropic strictly rejects consecutive same-role messages (400 error)
- Add post-processing step that merges consecutive user/assistant messages
- Handles string, list, and mixed content types during merge
## Tool choice support
- Add tool_choice parameter to build_anthropic_kwargs()
- Maps OpenAI values: auto→auto, required→any, none→omit, name→tool
## Cache metrics tracking
- Anthropic uses cache_read_input_tokens / cache_creation_input_tokens
(different from OpenRouter's prompt_tokens_details.cached_tokens)
- Add api_mode-aware branch in run_agent.py cache stats logging
## Credential refresh on 401
- On 401 error during anthropic_messages mode, re-read credentials
via resolve_anthropic_token() (picks up refreshed Claude Code tokens)
- Rebuild client if new token differs from current one
- Follows same pattern as Codex/Nous 401 refresh handlers
## Tests
- 44 adapter tests (8 new: vision conversion, role alternation, tool choice)
- Updated beta header tests to verify new structure
- Full suite: 3198 passed, 0 regressions
2026-03-12 16:00:46 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Role alternation
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestRoleAlternation:
|
|
|
|
|
def test_merges_consecutive_user_messages(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "user", "content": "Hello"},
|
|
|
|
|
{"role": "user", "content": "World"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assert len(result) == 1
|
|
|
|
|
assert result[0]["role"] == "user"
|
|
|
|
|
assert "Hello" in result[0]["content"]
|
|
|
|
|
assert "World" in result[0]["content"]
|
|
|
|
|
|
|
|
|
|
def test_preserves_proper_alternation(self):
|
|
|
|
|
messages = [
|
|
|
|
|
{"role": "user", "content": "Hi"},
|
|
|
|
|
{"role": "assistant", "content": "Hello!"},
|
|
|
|
|
{"role": "user", "content": "How are you?"},
|
|
|
|
|
]
|
|
|
|
|
_, result = convert_messages_to_anthropic(messages)
|
|
|
|
|
assert len(result) == 3
|
|
|
|
|
assert [m["role"] for m in result] == ["user", "assistant", "user"]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
# Tool choice
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class TestToolChoice:
|
|
|
|
|
_DUMMY_TOOL = [
|
|
|
|
|
{
|
|
|
|
|
"type": "function",
|
|
|
|
|
"function": {
|
|
|
|
|
"name": "test",
|
|
|
|
|
"description": "x",
|
|
|
|
|
"parameters": {"type": "object", "properties": {}},
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
def test_auto_tool_choice(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "Hi"}],
|
|
|
|
|
tools=self._DUMMY_TOOL,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
tool_choice="auto",
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["tool_choice"] == {"type": "auto"}
|
|
|
|
|
|
|
|
|
|
def test_required_tool_choice(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "Hi"}],
|
|
|
|
|
tools=self._DUMMY_TOOL,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
tool_choice="required",
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["tool_choice"] == {"type": "any"}
|
|
|
|
|
|
|
|
|
|
def test_specific_tool_choice(self):
|
|
|
|
|
kwargs = build_anthropic_kwargs(
|
|
|
|
|
model="claude-sonnet-4-20250514",
|
|
|
|
|
messages=[{"role": "user", "content": "Hi"}],
|
|
|
|
|
tools=self._DUMMY_TOOL,
|
|
|
|
|
max_tokens=4096,
|
|
|
|
|
reasoning_config=None,
|
|
|
|
|
tool_choice="search",
|
|
|
|
|
)
|
|
|
|
|
assert kwargs["tool_choice"] == {"type": "tool", "name": "search"}
|